Deutsche Bank Says Software to Detect Money Laundering Had a Bug

https://www.nytimes.com/2019/05/22/business/deutsche-bank-money-laundering.html

by oldjokes • 7 years ago

157 103 7 years ago

Bug or feature?

Also, wonder how they're verifying "The bank maintained that no suspicious transactions had slipped through as a result."

supakeen2• 7 years ago

Rerun a new release over the mutation log that it previously watched :)

gruez• 7 years ago

1. fix bug, run through the data again

2. get a bunch of low level analysts or interns to review all past transactions

wahern• 7 years ago

3. Executive: "Hey, Charlie, you think that bug missed anything?" Manager: "None that I'm aware of."

0x262d• 7 years ago

yep, just 10 years of financial data. I'm sure they could replay that easily lol

sd_mikey• 7 years ago

They should do some back testing to verify the validity of the updated software. This would uncover past fraudulent activity and possibly any new bugs introduced by the fix.

SiempreViernes• 7 years ago

Maybe they called all their "fishy" friends to confirm they caught all their bad stuff?

More seriously, the background seems to be that DB has poor controls overall, so likely this tagger was simply combined with something too permissive and the error ends up not mattering very much.

sametmax• 7 years ago

Giving that I've already been approached by gov officials to create an accounting software that helps with creative book keeping, I say don't assume incompetence on this one.

jerf• 7 years ago

'Also, wonder how they're verifying "The bank maintained that no suspicious transactions had slipped through as a result."'

I have no inside information, but I will observe there's a well-traveled road where organizations end up loudly announcing they couldn't find any exploitation of a given bug, or that it was limited to scope X, only to later announce that, oh, whoops, they found some, or that the scope was larger than they thought.

Sometimes I find it easy to believe it's honest, like an ongoing security incident for a relatively transparent organization where the news is only hours old. Sometimes... I find it quite easy to believe it's not honest. I don't have enough info to decide in this particular case but it wouldn't shock my priors for it to be the latter here.

duxup2• 7 years ago

It would be interesting to know what the bug is.

I can't translate the German site as I can't really get to it due to a popup.

A math problem, just not checking some transactions, something else?

supakeen2• 7 years ago

"In one of these applications, two of the 121 parameters were not defined correctly. What the exact parameters are, the speaker did not want to say."

Is all the further information in the German article.

duxup2• 7 years ago

Thank you.

Merem• 7 years ago

Which resulted in an incomplete second check of payments.

(Just to add the other small part.)

lmb• 7 years ago

It doesn't give any specifics. "2 of 121 parameters were configured incorrectly". Maybe host and port? ;)

smn12342• 7 years ago

how convenient, with this in context https://www.nytimes.com/2019/03/18/business/trump-deutsche-b...

TACIXAT• 7 years ago

Large loans and real estate deals are not the type of money laundering this software detects. It is looking for unusual transaction flows between accounts. For example, if an account receives large amounts money for inconsistent purposes (e.g. computer services and farm equipment), or has large amounts of money flow through it while maintaining a relatively low average balance (e.g. 10 million received and sent when the account normally has 40k in it).

While money is absolutely laundered via real estate and art, that's not what this software detects. The podcast The Dark Money Files is really good if you want to learn more about this. [1]

1. https://www.buzzsprout.com/242645

drak0n1c• 7 years ago

It's not convenient, or relevant, if you read the other real estate focused reply to your comment. If anything, it is convenient for the NYT's news cycle to focus disproportionate attention on myriad related-only-by-keyword events within a short amount of time for the sake of spinning narratives about specific companies and garnering clicks.

Facebook received the same treatment, once they lost their golden boy status.

PLenz• 7 years ago

It's not at all unusual to have runs of stories. Stories are not independent things. Stories are the public face of a background process (investigative reporting) that surfaces many interrelated aspects of an issue. Waiting for all the pieces to fall into place is waterfall development, you'd never ship. Writing many stories as the facts become known/interpretable is agile. Stories build over time.

SrslyJosh• 7 years ago

How incredibly convenient.

lawrenceg• 7 years ago

I see some similarities here between VW Dieselgate and DB. Must be a German thing :)

blattimwind• 7 years ago

Germany is already kinda the money laundering capital of the EU.

outside12343• 7 years ago

But only because Switzerland isn't in the EU.

spikels2• 7 years ago

This is news?! All software has bugs. NYTimes is taking advantage of the general public’s ignorance of this fact to imply something sinister. Without additional information - such as it specifically targeted certain transactions - that is misleading.

Remember this when you read articles about subjects you are not knowledgeable about.

https://en.m.wikipedia.org/wiki/Gell-Mann_amnesia_effect

mola• 7 years ago

On the other hand, these businesses cause the public ignorance For example companies that offer all sort of AI solution as some magic bullet. While covering up the inherent "bugs" in such systems.

skywhopper• 7 years ago

It's a bad headline and low-content article, but that's not really the point. The bug presumably made some filter for suspicious transactions ineffective, and this was detected by some sort of manual process audit. The headline should have been "Deutsche Bank fails to properly audit its money laundering detection for 10 years".

PhasmaFelis• 7 years ago

When a company publicly apologizes for a bug and says things like "Deutsche Bank is working on correcting the error as quickly as possible and is in close contact with the regulators," a reasonable person infers that they're talking about a serious issue in core functionality, not a GUI rendering glitch.

fareesh7• 7 years ago

It seems to me as an outsider that everyone's standard for honesty has been reduced because it's an acceptable sacrifice if it means sliming the opposing political party. This has undertones of conveying that the President "got away" with this activity, which is the intended takeaway from the article.

The quality of journalism seems to have been hit hardest by this philosophy. For over a year all of us around the world have been hearing about something called a Mueller Investigation from the news media in the USA, and now despite the fact that it has cleared the President and his campaign of the allegations made, not a single media outlet has walked back the insinuations made with this style of reporting which, through lawyerspeak essentially declared him guilty without saying it outright, but close enough for it to convince the general public.

It's really unfortunate because the media has a very important responsibility. Based on the behavior of journalists that I see on social media, it seems like overgrown children are running things. One such example is a lady named Sarah Jeong who has written some really disgusting tweets on social media, and was given a relatively important position at NYT.

sjg0073• 7 years ago

The Mueller Report that totally exonerates the President and yet the President won't release it in full to Congress. The only one sliming the President is Trump himself.

notfromhere5• 7 years ago

The report specifically didn't clear the president of anything; it does describe multiple instances of obstruction of justice, lying by Trump campaign associates, and destruction of evidence.

notfromhere5• 7 years ago

DB has been caught laundering money multiple times over the years, is under a Treasury order to crack down on it, and has faced billions of dollars in fines over its money laundering activities.

You don't need to imply anything sinister, the sinister stuff is fact

Spooky23• 7 years ago

Consider that a former US state governor was pinched within hours by his bank transferring a few thousand bucks domestically to an escort service.

Mysterious "software bugs" that allow people to transfer millions of dollars to questionable characters in known corrupt countries are excuses, not defects. I guarantee that if you or your LLC wired >$5k regularly to somebody in the Ukraine every once in awhile, the best case for you would be your account being frozen.

bla3• 7 years ago

Subjectively it feels like NYT publishes a lot more negative articles about Deutsche Bank than about any other bank, or at least those articles get upvoted much more frequently here. Does anyone know what's up with that? I would've assumed that most banks are equally terrible.

smn12342• 7 years ago

Trump did a majority of his deals with them and both entities grew with each other. A lot of the deals had override approvals without a lot of review.

A link I posted earlier in this thread - https://www.nytimes.com/2019/03/18/business/trump-deutsche-b... provides more on this.

Consultant32452• 7 years ago

I wish there was more clarity here. It's my understanding that every large transaction requires some amount of manual approval at banks and this happens all the time every day. I have no issue believing Trump has shady banking/real estate deals, I think that's ultimately what might undo his Presidency, but transactions needing/receiving low level approvals doesn't read like a scandal to me.

jpfed• 7 years ago

Deutsche Bank is somewhat notable from a political standpoint; Donald Trump got loans there after no other banks would work with him, and retired SCOTUS justice Anthony Kennedy's son worked there.

fwip• 7 years ago

Deutsche Bank is currently implicated in (or at the very least, relevant to) ongoing news regarding the US President's finances.

That makes it more newsworthy.

evenmore6789• 7 years ago

Old habits die hard. Watch the movie 'Leon, the Professional, https://www.imdb.com/title/tt0110413/ , and you will know who you are. Old habits die hard. Cold or no cold/hot coffee.

repolfx2• 7 years ago

So, are the Germans the new Russians then? Sounds like having failed to pin a dozen or so different crimes on Trump now his enemies are trying to harass his banks in retaliation for working with him? A classic strategy. Any bank can be found guilty of money laundering if the authorities want because the wording of the laws are so vague.

neves• 7 years ago

American newspapers are blatantly nationalist. It is very hard to point to problems in their companies. Obesity problems? Nestle is is the villain: https://www.nytimes.com/interactive/2017/09/16/health/brazil...

Environment accident with an American oil company? They are victims from a foreign gov: https://www.nytimes.com/2011/11/19/business/energy-environme...

Antivirus malicious companies? It's always Kaspersky problem: https://www.nytimes.com/2018/01/01/technology/kaspersky-lab-...

outside12343• 7 years ago

What???? There has been ton of bad press for Google, Facebook, Exxon Mobile, ...

throwawaymath• 7 years ago

I don't know if the NYT actually does publish more negative articles about Deutsche Bank than other banks. But if what you're perceiving matches reality, I would assume it is for the following two reasons:

1. Deutsche Bank facilitated a basket option trading strategy used by Renaissance Technologies, which has since earned the latter an investigation from the IRS for aggressive tax avoidance. RenTech is (unfortunately) synonymous with Robert Mercer's political activity in the eyes of many because he was a major partner and CEO of the hedge fund before he stepped down last year. This leads to my second point.

2. Deutsche Bank is (separately from RenTech) involved with Donald Trump in a number of real estate dealings, which other commenters have already cited. Regardless of your personal stance on the president, the NYT is going to spend time investigating any areas of financial misconduct it can find which may be directly or indirectly related to the president.

auntienomen• 7 years ago

Also, Deutsche Bank (along with HSBC, iirc) took quite a lot of dirty money during the financial crisis. And there was that Libor thing...

Most (perhaps all) of the big banks have a list of fines, crimes, and scandals, but Deutsche Bank's list seems particuarly egregious.

andrewstuart2• 7 years ago

As someone who works at a financial institution, it's news generally because money laundering activity tends to be highly profitable for banks, since they get to collect fees on those transactions. There are almost no incentives for us to flag transactions on our own (unless we're being super humanitarian) without legislation/regulation, because as long as they get their money there's no downside except for victims of the crimes that the money originally originated from.

At least in my opinion, the legislation and big-deal-making is merited in cases like this, for the benefit of society.

candiodari• 7 years ago

As an ex-consultant in the financial services sector I strongly disagree with your assessment:

"there's no downside except for victims of the crimes that the money originally originated from."

Why don't you detail what happens to people who get flagged by this software. Ie either send or receive suspected laundered money and what the odds are of such a flag actually resulting in a conviction.

If you get "flagged", ALL your funds are immediately blocked, your access restricted however long they wish (meaning think 6 months). The odds of a flag leading to a conviction are not even 2%. Even among those 2%, the vast majority of "money launderers" are victims of deception (for example the old "I'll send you money if you pay me 5/10/20% less of that money on a different account").

So no victims ? The truth is that a few thousand people per month (never saw absolute numbers but that seems a lower bound to me, and this is for a small EU country) are denied access to their own money for months (sometimes years), without so much as an explanation (it is illegal (and legally highly stupid) for the bank to state for what reason your accounts are blocked). Not one of their accounts, all of them. Needless to say, finding stories where this has resulted in making a person or even entire family homeless is not hard.

"No downside". Well, not for banks. Not for governments. For everyone else, extreme downsides.

colanderman• 7 years ago

I think you misread the comment. At least, I read it as "no downside to ignore money laundering", not "no downside to crack down on it".

voronoff• 7 years ago

I don't think you read their comment correctly.

They are saying that their is no downside, outside of running foul of laws and regulators, for banks to take money without review instead of flagging transactions as suspicious.

Your response is about additional benefits for them taking the money without questions.

usrusr4• 7 years ago

Finance lobbying power must be weaker than popularly assumed if they failed to inspire a proportionate finder's fee that would make flagging worthwhile.

Of course, if I tune my cynicism level a bit darker that line of thought breaks down again, because then I start factoring in the possibility of "premium service tiers" with fees so high that a) no client in their right mind would ever consider them unless they have very pressing reasons to be friendly with the bank and b) no reasonable finder's fee could ever hope to win the bidding.

nostalgk3• 7 years ago

Why would lobbyists work towards rewarding those who flag money laundering transactions when, presumably as presented by the parent comment, they make money off of these transactions? If anything, they would be lobbying against a finder's fee.

If we take the parent comment to be true, the fees levied against the institution for being caught (provided they can't worm their way out of it in the first place) are merely a slap on the wrist.

mrfredward• 7 years ago

Is the idea of a finder's fee so negative? If banks regulators and the banks came up with a plan where sniffing out money laundering was rewarded and banks made extra money helping the justice system take on financial crime...isn't that the best possible outcome?

Of course the danger of such a system is banks would be overzealous in their reporting in the hopes of getting a lucky payout. That's another pitfall that would need to be addressed with fines or incentives. My point is that it's not inherently bad when businesses are rewarded for doing the right thing.

dogma1138• 7 years ago

Not only that there is no downside for banks but they actually profit much more from money laundering than from most legitimate transactions (relative not necessarily absolute) because of how layering works and the sheer amount of transactions and entities which are involved in the process.

The only people who get hurt are the patsies whether low to mid tier bank employees who are left hanging in large case or the victims of the laundering process which can be tricked into participating in the process through deception e.g. P2P loan schemes and transfer schemes or those who are employed by shell entities used in layering.

If you are getting flagged for money laundering you are utterly fucked.

You can’t access any of your accounts, your credit is frozen, even if you by some luck don’t lose your employment even your paycheck can be directly or indirectly withheld and you will be audited by your friendly tax authority.

The shadow economy is huge in many places it can be as large or even larger than the real economy and many nations including EU members actively support it because they rely on it.

Kuraj• 7 years ago

Used to work at an investment bank (IT), are you saying all those recurring mandatory trainings on how to detect and report money laundering were a sham?

brmgb2• 7 years ago

There are almost no incentives for us to flag transactions on our own (unless we're being super humanitarian)

I like how you frame avoiding profiting from crime not only as being humanitarian but actually as being super humanitarian.

To be honest, I find your comment quite frightening. I think bankers viewing being honest as a humanitarian act is in and of itself a much larger problem than faulty software.

woah• 7 years ago

Why do we still allow people to use cash? How much humanitarian good could we do by banning it once and for all? Gold is also a potent laundering tool, it can be re melted at a low temperature. It’s shocking that it’s still allowed.

solveit• 7 years ago

And I like how you immediately decided to alienate somebody clearly on your side pointing out a systemic problem by moralizing at them.

Flagging suspicious transactions and verifying that they're legit is costly. Spending money to reduce profit for the common good is humanitarian. It has little to do with being honest. If the bank does nothing, the bank doesn't lie, it just doesn't go out of their way to verify that other people aren't dishonest. And the fact that people view letting bad things happen by inaction as less bad (or even not bad) shouldn't be a surprise. It's just human nature. And when someone pointed this out, you decided they were Bad and Frightening. Because they said people will follow incentives in a well-known moral hazard scenario. Get a grip.

eigenvector• 7 years ago

If you read the original article cited by the NYT (it's in German), it is using 'bug' not in the sense that all software has bugs, but in the sense of 'basic functionality was not working'. And that should be alarming, for critical software.

https://translate.google.com/translate?hl=&sl=de&tl=en&u=htt...

tantalor• 7 years ago

How can it possibly be both "basic functionality was not working" (high severity) and "no suspicious transactions had slipped through" (low severity)?

Harvey-Specter• 7 years ago

Pretty easy to understand if you swap what the software is detecting to "asteroids which are on impact course with earth". Basic functionality is to detect asteroids which are on a collision course with earth. The fact that no undetected asteroids struck earth doesn't mean the software worked or didn't work, nor does it mean that detecting asteroids which are on a collosion course with earth is not basic functionality.

notfromhere5• 7 years ago

I'm sure they knew, kept the problem around so that whenever they inevitably got caught they could point to the software glitch.

Deutsche Bank has been revealed to be systematically laundering Russian cash for years, to the point where you see a headline about "bank gets caught laundering Russian money" its almost always DB.

akhilcacharya• 7 years ago

It’s not a bug, it’s a feature

outside12343• 7 years ago

Yeah right. Just like VW's emissions bug.

hef19898• 7 years ago

Somebody say again we Germans aren't good at software!

slg• 7 years ago

This is a little different because Deutsche Bank is already under scrutiny in this area and therefore this is one piece of a larger story. It is similar to when Facebook has bugs that expose private user information. It raises questions like whether the "bug" is truly a bug or whether it is intended behavior, whether no bug exists and this is simply an easy excuse for inappropriate actions, whether the company actually cares about fixing the issue, and so on.

EDIT: I am sure what happened in this thread. Several comments, including this one, were decoupled from the comment they were responding to even though the original wasn't deleted or flagged. Removing that context makes some of these comments harder to follow.

chasingthewind• 7 years ago

The Base Rate Fallacy [0] suggests there's often a lot more true negatives than true positives. In this case a true negative is ignoring a non-fraudulent transaction and a true-positive is catching a fraudulent transaction.

As someone who never engages in fraudulent transactions, if I were a DB customer I'd be much more concerned about the false-negative rate of such software.

[0] https://en.wikipedia.org/wiki/Base_rate_fallacy

maxencecornet• 7 years ago

Paul Jorion, a french writer and ex-"the Bank of the European Union" employee, said that he was pushed out of the company when he revealed a bug in risk-calculation software

I'm pretty sure this bug was known for some time as well

carreau• 7 years ago

bug for 10 years

*backdoor

chockZ• 7 years ago

You need to consider the larger context of this story, especially given Deutsche Bank's notorious reputation for allowing money laundering to happen under it's watch. Also, take a look at the story published last week about American Deutsche Bank executives refusing to pass along information to federal regulators regarding suspicious transactions involving the President of the United States and his son-in-law.

https://www.nytimes.com/2019/05/19/business/deutsche-bank-tr...

YeGoblynQueenne• 7 years ago

Financial software doesn't have bugs like web applications have bugs. In one place I worked the software was older than every person who worked in the company (from the time of punched cards) and the system had 5-9s uptime. The majority of bugs had been caught and fixed by then and to change anything in the software you had to submit a ten-page form. Plus, nobody I knew ever got to work on the actual code running the company's main business - you only got to write job running scripts and the like.

In that kind of shop a bug is a big deal.

coldcode• 7 years ago

It's not a bug it's a feature: the bank rakes in money and no one is the wiser.

otakucode• 7 years ago

Financial software is special. It has to be. The value of our currency is literally directly dependent upon it. Imagine what would happen if tomorrow we woke up and it was revealed that there had been a persistent manipulation of the financial systems. When Walmart or some other large company goes to another country and says "we have $5 million, we need good and services" they would be met with "we don't believe those numbers in your bank software MEAN anything. PROVE they represent money and aren't just a bug." At that point, everything stops.

Well, everything that has no built-in means of proving legitimacy. I've read multiple times that the only real thing Bitcoin offers is protection against counterfeiting and no one gives a damn about that because faith in the system backs our money so counterfeiting isn't a big problem. In the hypothetical scenario, though, it becomes the primary problem, and overnight only cryptocurrency can be proven to mean anything at all. Everything else would just be unreliable nonsense numbers based on rotted code.

pablooliva• 7 years ago

The software was as buggy as management overseeing regulation of shady transactions at the firm: https://duckduckgo.com/?q=deutsche+bank+whistleblower&t=cano...

NTDF9• 7 years ago

One bug? That's laughable to anyone writing any software

mmanfrin• 7 years ago

Cue $20 mil fine and $X bil profits washed clean.

sova• 7 years ago

Just one bug though. And it sounds like they found it. Phew.

NicoJuicy• 7 years ago

For the ones that don't see the links, Trump had to show his bank records of Deutsche Bank in the accusation of Russian money laundering.

And now they found a bug :)

kumarvvr• 7 years ago

Interesting timing, considering all the subpoenas they are supposed to reply to.

craftoman• 7 years ago

I remember similar answer was given from a bunch of corrupted employees after the Greek state found that their anti-corruption algorithms (written in Python btw) stopped reporting for incidents. In the end, after the inspection from major supervisors found that those guys working at the post over there "accidentally disabled" the reporting service and blamed the software.

Deutsche Bank Says Software to Detect Money Laundering Had a Bug

Related Stories